Scammer loses $5M in Bitcoin after Ledger theft
\n
What happened
\n
A fraudster who ran a so‑called task scam lost about 60 bitcoins worth roughly $4.8 million. The stolen funds were originally taken from victims of a scheme that promised payments for fake sales and reviews.
\n
On September 22 the scammer moved the proceeds into three separate Ledger hardware wallets. On October 9 thieves emptied all three wallets, sending one transfer each into a single destination wallet.
\n
Key numbers
\n
- \n
- 60 bitcoins stolen (~$4.8 million) \n
- Three Ledger addresses used \n
- Theft dates: Sep 22 and Oct 9, 2026 \n
- Reported total loss by investigator: $86 million (unconfirmed) \n
\n
Ledger’s statement
\n
Ledger, the Paris‑based hardware maker, opened an investigation after customers in Southeast Asia reported losses from a Malaysia‑based reseller called CryptoBilis.
\n
The company says an organized crime group installed malicious implants in devices that could read seed phrases, allowing criminals to drain wallets. Ledger says it is working with law‑enforcement to follow the funds and stop the attackers.
\n
Ledger confirmed that CryptoBilis has stopped selling Ledger products and that no other vendors have been targeted.
\n
Other reports
\n
Chainalysis disclosed the loss in a Thursday post, linking the address to the task‑scam operation.
\n
A blockchain investigator named Specter claimed $86 million had been drained, though Ledger has not released an official total.
\n
The July attack on Coldcard hardware, which affected a firmware bug, resulted in the theft of about $120 million in bitcoin from users.
\n
Confirmed details
\n
• 60 bitcoins (~$4.8 million) were lost.
\n
• The original scam was a task scam where victims were told to add their own money to receive payments for fake sales.
\n
• The scammer moved the funds to three Ledger addresses on Sep 22.
\n
• Thieves emptied the three addresses on Oct 9.
\n
• Ledger launched an investigation and identified implants that could read seed phrases.
\n
• Ledger is cooperating with law‑enforcement and has halted sales through CryptoBilis.
\n
Uncertainties
\n
The exact total amount lost in the Ledger breach is not confirmed by Ledger. The $86 million figure comes from a private investigator, not from the company.
\n
Why this matters
\n
The incident shows how compromised hardware wallets can be used to steal large sums even after stolen funds are moved to secure devices.
\n
It also highlights the risk of buying Ledger products from unauthorized resellers, as implants can expose seed phrases.
\n
Next steps
\n
Ledger continues to work with authorities to track the funds and dismantle the attack infrastructure.
\n
Customers are advised to verify the authenticity of hardware they purchase and to use secure practices for seed storage.
\n
Sources
\n
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.